fix(delete): review follow-ups — admin Deleted filter, guest gate, dialog spacing

- Admin /users gains a Deleted scope (between People and Robots); every other scope now
  hides tombstoned accounts (deleted_at filter in UserFilter).
- Admin delete-user is offered for any non-deleted account (drop the not-guest gate, so a
  stale is_guest account can still be tombstoned).
- Harden EmailService.ConfirmCode to ClearGuest — defence-in-depth so no confirmed-email
  path leaves is_guest set (the currently-live paths already do).
- Space the delete/change dialog's action row from its input field.
Integration tests: the Deleted filter scoping + ConfirmCode guest promotion.

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -119,11 +119,11 @@
 </tbody>
 </table>
 {{end}}
-{{if not .Deleted}}{{if not .Guest}}
+{{if not .Deleted}}
 <form class="form" method="post" action="/_gm/users/{{.ID}}/delete" onsubmit="return confirm('Delete this account? Its credentials are journalled and freed, its data anonymised, and its sessions revoked. This cannot be undone.')">
 <button type="submit">Delete user</button>
 </form>
-{{end}}{{end}}
+{{end}}
 </section>
 <section class="panel"><h2>Friends</h2>
 <table class="list">